How to notice the pressure a scam puts on you, check any caller on a line you control, refuse every payment and access trick, and lock your accounts so a stolen password is not enough.
Doctor's Note: A scam can hurt more than your bank balance. Fraud victims report anxiety, depression, shame and loss of trust [1]. If worry, poor sleep or low mood carry on for more than a couple of weeks, see your doctor. If you ever think about harming yourself, call your local emergency number now. In older adults, low scam awareness was linked to a higher later risk of memory problems and dementia [2], so if a parent suddenly starts falling for offers they once ignored, suggest a check-up with their doctor.
If money has already left your account, stop reading and call your bank now on the number on the back of your card, from a different phone if you can [3]. Then report it, for example: UK, Report Fraud at reportfraud.police.uk or 0300 123 2040; Canada, the Canadian Anti-Fraud Centre at 1-888-495-8501 or reportcyberandfraud.canada.ca; US, ReportFraud.ftc.gov. Elsewhere, contact your local police. The full first-hour plan has its own article, listed under Go further.
How a Scam Actually Works on You
Every scam has the same job: get you to act before you check. The story changes (a bank, a parcel, a grandchild, a prize), but the method does not. It raises your feelings, borrows someone else's authority, cuts you off from the people who would spot the trick, and then steers your money into a channel that is hard to reverse.
That gives four places to stop it, and each step in this article covers one of them. Step 1 catches the pressure. Steps 2 and 3 break the fake identity. Step 4 closes the payment and access channels. Step 5 locks your accounts so that even a stolen password gets nowhere. Step 6 turns all of it into a habit you can measure.
One phrase holds it together: Stop, Check, Talk. Stop when you feel pressure. Check by calling back on a number you found yourself. Talk to someone you trust before any money moves.
Step 1: Spot the Pressure: Urgency, Authority and Secrecy
SKILL: You can spot a scam by its pressure: urgency, authority or "don't tell anyone" means stop, and you say "a real request will wait while I check".
WHY THIS MATTERS
In a randomized lab study, researchers split 231 adults, aged 30 to 40 and 65 to 85, into groups that were made excited with rigged wins, made frustrated with rigged losses, or kept calm [4]. Then everyone looked at misleading adverts that a consumer protection agency had flagged [4]. Both the excited and the frustrated groups said they were more likely to buy, with no difference between younger and older adults [4]. The adverts did not seem more believable to them; only the wish to buy went up [4]. Feelings change what you do before they change what you think.
Scammers create those feelings on purpose, using three levers. Europol lists a feeling of emergency, pressure, and a request for absolute confidentiality among the signs to know [3]. The FTC adds that scammers often pose as a government agency, a well-known business, or both [5]. Urgency stops you thinking, authority stops you questioning, and secrecy stops anyone else from warning you.
- Learn the three stop signs by name. Urgency: "act now", "your account closes today", a feeling of emergency [3]. Authority: "this is your bank", "the police", "the tax office" [5]. Secrecy: "don't tell your bank or your family" [3].
- Treat any one stop sign in a contact you did not expect as enough to pause. You do not need all three.
- Treat secrecy as the strongest sign. A real bank, police force or tax office has no reason to stop you from talking to your family. "Don't tell anyone" is your cue to tell someone at once.
- Watch for the extra pressure signs Europol names: an unusual request that skips the normal steps, a sudden change in someone's payment details, and an offer to move your money to a "safe account" [3].
- Notice your body. A racing heart, a hot face or a rush of hope during a call about money means your feelings are high, which is the moment to hold off [4]. Breathe out slowly three times before you answer.
- Say this sentence out loud, every time: "A real request will wait while I check." Write it on a sticky note by your phone.
- Set one rule for money: no payment, transfer or code on the same call, chat or email where it was asked for. Decide only once your feelings have settled [4].
Practice drill (5 minutes, once a week): open your spam folder or text messages, pick one suspicious message, and name the stop sign it uses. Then say your sentence. A habit you have rehearsed is easier to reach for under stress than one you have only read about.
When it does not work
- "It didn't feel urgent, it felt friendly." Warmth is pressure too. Unusual flattery and promises of reward are on Europol's list of warning signs [3]. Check the request, not the tone.
- "I froze and couldn't think of the sentence." Say only the first word, "Wait", and hang up. You can be polite later, on a number you found yourself.
- "They knew my name and my bank." The name on the screen and the details they quote are under their control too [3]. Only a call you start on a number you found yourself proves who you are talking to.
Expected results
Within a week you can name the three stop signs, your pause sentence is by the phone, and you have one written rule: no money moves on the contact that asked for it.
Caution: The study measured what people said they would buy, not real purchases, and its groups were small [4]. Waiting until you are calm still costs nothing and fits every official warning in this article.
Step 2: Hang Up and Call Back on a Number You Already Have
SKILL: You can verify a caller by hanging up and calling back on a number you already have, so a faked caller ID gets nowhere.
WHY THIS MATTERS
Caller ID is not proof. Fraudsters use apps that fake the caller's identity, so your screen shows the number of the company, office or person they pretend to be [3]. The number they give you, the link they send and the name on the screen are all under their control.
There is a second trap. Europol warns that some callers tell you to ring them back on an official line, then keep the connection open after you hang up, so the "official" voice you reach is still theirs [3]. The FBI and Europol give the same core advice: hang up, find the organization's number yourself, and dial it directly [6], using another phone if you were called [3]. Verification only works when you start the call.
- Tonight, save your bank's fraud number in your phone as "Bank FRAUD", copied from the back of your card or a paper statement [3]. Do the same for your phone carrier and anyone else who handles your money.
- When any unexpected call or message asks for money, codes or personal details, end it. Do not press a number, do not click the link, and do not call the number they give you [3].
- Use a short script so hanging up feels normal: "I don't deal with this on incoming calls. I'll call the bank myself." Then hang up, even mid-sentence.
- Call back on the saved number, from a different phone if you have one, because the scammer may still be on your line [3].
- Do the same for texts and emails. If a message says it is from your bank or a tax office, open the official app or type the website address yourself instead of using the link [3].
- If someone you pay regularly says their bank details have changed, confirm it with them on a number you already had, because the contact details in the message may have been changed too [3].
- Block numbers you know are fraudulent so they cannot call you back [9].
When it does not work
- "They said if I hang up, my account will be frozen." That threat is itself a stop sign. A real bank will not mind you calling back [3].
- "The website in the email looked exactly right." Copycat addresses can differ from the real one by a single character [3]. Typing the address yourself avoids the problem completely.
By the end of today your bank's real fraud number is saved, you have a one-line script for hanging up, and you know to call back from a different phone.
Step 3: Set a Family Code Word That Beats a Cloned Voice
SKILL: You can set a family code word for emergency calls, and trust the call-back and the code word rather than a voice or a face on video.
WHY THIS MATTERS
The FBI warns that criminals make short audio clips of a loved one's voice to fake a crisis call, and use cloned voices to pose as account holders with banks [6]. They also make videos for real-time video chats with fake company bosses, police officers and other authority figures [6].
The FBI does list clues of a fake, such as distorted hands, odd teeth or eyes, strange shadows, lag and unnatural movement [6]. But fakes keep improving, so its first tip is simpler: create a secret word or phrase with your family to check who you are talking to [6]. A code word does not depend on how good the fake is.
- Choose a code word tonight [6]. Pick something that has never been online: not a pet's name you have posted, not a birthday, not a school. A made-up pair works well, such as "blue kettle 47".
- Share it face to face, not by text, email or a family group chat that could be read later.
- Agree one rule with everyone: on any call, voice note or video asking for money or urgent help ("Mum, it's me, I've been arrested, I need money for a lawyer"), the caller must give the word. No word, no money.
- Ask for it calmly: "What's our word?" A real family member will understand. A scammer will dodge, get upset or say there is no time, which is a stop sign in itself.
- If the caller cannot give the word, hang up and call the family member on the number saved in your phone [6].
- Treat video the same way. A face on a screen can be fake [6]. If a "boss", "officer" or "official" on video asks for money or secrecy, hang up and call their organization on a number you found yourself [6].
- Reduce what can be copied. Where you can, limit public photos and videos of your face and voice, make social media accounts private, and limit followers to people you know [6].
When it does not work
- "Someone forgot the word in a real emergency." Then the call-back from Step 2 decides. Hang up and ring their saved number, or another family member who is with them.
- "The word got shared in a text." Change it. A code word is only as good as the number of places it is written down.
- "A relative lives far away and we rarely meet." Agree it on a video call you started yourself, to a number you already had.
By the end of tonight your household shares a code word that has never been written online, and everyone knows the rule: no word, no money.
Step 4: Refuse the Payment and Access Tricks
SKILL: You can refuse every payment and access trick: no gift cards, crypto or wire transfers, no sharing one-time codes, no remote access, and you ask someone you trust before you pay.
WHY THIS MATTERS
Even when a scammer gets your attention, they still need one of three things to take your money: your codes, a payment that is hard to reverse, or access to your device. India's central bank reminds people that banks and payment operators never ask for a password, PIN, OTP or CVV [7]. The FTC warns that anyone who says you can only pay by bank transfer, wire, crypto, a payment app or a gift card is probably a scammer [5]. Europol warns that a program a caller asks you to download can give them access to your device, your data and then your bank account [9].
Credit cards work differently from those channels. The FTC advises paying by credit card whenever possible, because it gives you the option to dispute charges [5].
- Never share a one-time code, PIN, password, CVV or card details with anyone, even someone who says they are your bank, your phone company or the police [7].
- Never pay by gift card, crypto, wire or payment app because someone contacted you and said you must [5]. A request to move your money to a "safe account" is a warning sign too [3].
- Pay by credit card where you can, so you can dispute a charge [5].
- Never install an app or give remote access to someone who contacted you. Hang up on any unexpected call claiming there is a problem with your computer, and download software only from official websites [9].
- Do not store your banking passwords or PINs on your phone, in email or in notes [7].
- Write your three nevers on a card and keep it by your phone or on the fridge: "Never share a code. Never pay by gift card, crypto or wire. Never give remote access."
- Add the "Talk" habit: before you pay anything a caller or new online contact asked for, check with one person you trust, even if you were told to keep it quiet [3]. Name that person now and tell them they are your "money check" person.
When it does not work
- "They said the gift card was to pay a fine or a tax." Anyone who says you can only pay by gift card is probably a scammer, whatever the reason given [5].
- "I already read out a code." Act now: call your bank on the saved number from a different phone [3]. The first-hour article under Go further has the full plan.
- "My money check person isn't answering." Then the answer is "not today". Nothing real will be lost by waiting a day.
By the end of this step your three nevers are on a card by the phone, you have named your money check person, and you pay by credit card where you can.
Step 5: Turn On Two-Step Sign-In: Email First, Then Bank, Then Phone
SKILL: You can lock down your accounts in one evening: two-step sign-in on email first, then bank and phone carrier, plus alerts for every transaction and new payee.
WHY THIS MATTERS
In a large set of Microsoft accounts showing suspicious activity, two-step sign-in cut the risk of compromise by 99.22% overall, and by 98.56% even when the password had already leaked [8]. More than 99.99% of accounts with two-step sign-in stayed secure during the study period [8]. Authenticator apps did better than text-message codes, and both beat having nothing [8].
The order matters. The UK's National Cyber Security Centre explains that anyone who gets into your email can reset all your other account passwords [10], so email is the master key. Your bank holds the money. Your phone account matters because a criminal who moves your number to their own SIM can use it to get into accounts that use your phone number to check who you are [11].
Alerts are the last layer. Singapore's ScamShield advises lower transaction limits and transfer alerts at a low threshold, so any unauthorised payment can be reported as soon as possible, which improves the chance of recovery [12].
- Email (about 15 minutes). Give your email a strong password you use nowhere else [10]. Then turn on two-step sign-in in your email's security settings, choosing an authenticator app if offered [8].
- Bank (about 15 minutes). Turn on two-step sign-in in your bank's app or website. Make sure its password is different from your email's [11].
- Phone carrier account (about 10 minutes). Sign in to your mobile provider's account, set a unique password, and turn on any extra security it offers [11].
- Alerts (about 10 minutes). In your bank app, set alerts for every transaction and every new payee, with the alert threshold as low as it goes [12]. Lower your daily transfer limit to the most you would send on a normal day [12].
- Read every alert. Report any payment you did not make straight away, on your saved fraud number [12].
When it does not work
- "My bank only offers text-message codes." Use them. A text code is still far better than a password alone [8].
- "I keep getting sign-in codes I didn't ask for." Someone has your password. Do not share the code, change that password at once, and make sure it is used nowhere else [10].
- "Too many alerts." Keep them on. The point is to hear about a payment within minutes, while there is still time to act [12].
- "My phone suddenly has no signal and no texts." Call your carrier and your bank at once from another phone; your number may have been moved [11].
By the end of the evening your email, bank and phone account each need more than a password, your email password is used nowhere else, and your bank tells you about every payment and new payee.
Step 6: Keep a 7-Day Scam Log and Score Your Five Checks
SKILL: You can keep Stop, Check, Talk ready every time: spot the pressure, check the caller, refuse the payment trick and keep your accounts locked, and see it in a weekly log.
WHY THIS MATTERS
The Stop, Check, Talk habit has to be ready on the night your feelings are high, because that is when judgment slips [4]. A short log shows you whether you are actually using it, and reporting attempts helps others: Europol advises contacting the police about fraud attempts even if you did not fall victim [3].
- For 7 days, log every unexpected call, text, email or message that asked for money, a code, a payment or personal details. One line each in your phone's notes: date, who they said they were, what they asked for, which stop sign, "checked: yes or no".
- Tick off the setup list: fraud number saved, code word agreed, three-nevers card by the phone, money check person named, two-step sign-in on email, bank and phone account, bank alerts on.
- On day 7, read the log. Aim for "checked: yes" on every line. If a line says "no", repeat the Step 1 drill and say your sentence aloud.
- Report attempts even when you lost nothing [3], using the reporting lines at the top of this article.
- On day 21 and then once a month, score yourself on the Skill Check table below. Work on the lowest score first.
After three weeks you have a log with "checked: yes" on every line and a full setup list, and you know which skill needs the most work.
Skill Check
| Skill | Starting | Solid | Strong |
|---|---|---|---|
| Spot the pressure | I notice pressure only afterwards | I name the stop sign during the call | I say "A real request will wait while I check" every time |
| Call back | I sometimes use the number they give | I call back on a saved number | I call back from a different phone, every time |
| Code word | No word yet | Word agreed with close family | Everyone uses it on every emergency call |
| Refuse payment and access tricks | I am unsure about codes and gift cards | I never share codes or pay by gift card, crypto or wire | I also check with my money check person before any payment someone asked for |
| Lock accounts | Password only | Two-step sign-in on email | Email, bank and phone account locked, alerts on every payment and new payee |
Special Groups
- Older adults. In a study that followed 935 older adults for about six years, low scam awareness was linked to a higher later risk of Alzheimer dementia and mild memory problems [2]. If a parent suddenly starts falling for offers they once ignored, gently suggest a check-up with their doctor. This is not a diagnosis, only a reason to ask.
- Anyone who has been scammed before. Fraud victims report anxiety, depression, shame and loss of trust [1]. Shame keeps people quiet, which is what scammers rely on, so the "Talk" habit matters most here. If worry or low mood lasts more than a couple of weeks, see your doctor. If you think about harming yourself, call your local emergency number now.
- People who live alone. Your money check person from Step 4 does the job of a family member. Singapore lets members name trusted contacts who get copies of important retirement-fund alerts without access to the account [12]; ask your bank whether it offers something similar.
Myths
"Only gullible or older people fall for scams." In the lab study, strong feelings raised the wish to buy equally in adults in their 30s and over 65 [4].
"If the caller ID shows my bank's number, it must be my bank." Caller ID can be faked with an app [3].
"My bank may ask me to read out a one-time code." Banks never ask for your OTP [7].
"I would know my own child's voice." Criminals can clone a loved one's voice from short clips [6]. Let the code word decide.
"Text-message codes can be stolen, so two-step sign-in is not worth it." Text codes were weaker than authenticator apps, but both were far better than nothing [8].
FAQ
Is it rude to hang up on someone who says they are from my bank? No. A real bank will not mind you calling back on its official number, and pressure not to hang up is a warning sign [3].
I gave a scammer a code a minute ago. What now? Call your bank now on the number on your card, from a different phone if you can [3], then follow the first-hour article under Go further.
Why does the caller keep telling me not to tell anyone? Because a request for absolute confidentiality is one of the signs of fraud [3]. Secrecy cuts you off from the people who would spot it.
Is paying by bank transfer ever safe? Paying someone you chose, through your own banking app, is normal. Paying by transfer because an unexpected contact said it was the only way is the warning sign [5].
Should I report a scam call even if I lost nothing? Yes. Europol advises reporting fraud attempts to the police even if you did not fall victim [3].
What to Do Next
- Tonight: save your bank's fraud number, agree your family code word, and put the three-nevers card by the phone.
- This week: spend one evening on Step 5, starting with your email.
- Next 21 days: keep the scam log from Step 6 and score yourself on the Skill Check.
Go Further
- How Scammers Trick Smart People: Hot Emotions, the Small First Yes and Sunk Costs goes deeper on why feelings override judgment.
- You've Been Scammed: What to Do in the First Hour has the full recovery plan: bank recall, closing the door, evidence and reporting.
- Lock Down Your Bank and Phone Against Hackers and SIM Swaps covers port-out PINs, passkeys and safe mobile banking.
- Lock Your Accounts: Passphrases, a Password Manager and Two-step Sign-in shows how to build passphrases, set up a password manager and keep backup codes.
- Tech Support Pop-ups, Prize Wins and Subscription Traps shows how to close a fake virus warning and recover after giving remote access.
- Guard an Older Parent Against Scams: Lottery Calls, Sucker Lists and Repeat Targeting helps families protect a parent who has been targeted.
- Teach Your Family to Spot Scams: Kids, Teens and Parents turns these habits into a family routine.
- Spot Investment and Crypto Scams and Check Any Firm Before You Trust It covers checking a firm's licence before you invest.
- Spot Fake Profiles, Bots, Catfishing and Romance Scams Before You Care covers scams that start with a new online friend.
